EUVD-2026-81047
GHSA-x4x4-phr8-wp7p
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H and UI:R capture the crafted field names plus required developer page render; PR:N because no app auth is needed though a malicious data provider is a precondition; arbitrary browser JS gives C:H/I:H, A:L.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
@refinedev/inferencer through 7.0.0 fails to escape API field names when interpolating them into generated JSX source code. Attackers controlling the data provider can inject malicious JavaScript through crafted JSON property names that execute in the developer's browser when the Inferencer page renders.
AnalysisAI
Refine's @refinedev/inferencer package through version 7.0.0 interpolates API field names straight into generated JSX source without escaping, so an attacker who controls or has compromised the data provider can supply crafted JSON property names that execute as JavaScript in a developer's browser when an Inferencer-generated page renders. Remote, unauthenticated input is possible per the published vector (PR:N), but exploitation is gated on developer interaction (UI:P/UI:R), a malicious or untrusted backend (AC:H/AT:P), and a developer actually previewing Inferencer output - hence our independent assessment rates real-world risk materially below the 7.7 CVSS 4.0 headline, and no public exploit code was identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker control (or have compromised) the data provider / backend API that the refine application consumes, so that crafted JSON property names can be returned. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a code-injection flaw (CWE-94) in a developer-time scaffolding tool, and the real-world risk is materially lower than the 7.7 CVSS 4.0 headline suggests. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patched version is not confirmed in the available data - no exact fix version appears in the advisory references, which point only to upstream issue https://github.com/refinedev/refine/issues/7556 and the VulnCheck advisory https://www.vulncheck.com/advisories/refinedev-inferencer-through-7.0.0-code-injection-via-api-field-names - so upgrade @refinedev/inferencer to the first release after 7.0.0 that the maintainers designate as fixed and re-run generation, treating any 0.x-7.0.0 pin as vulnerable until then. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all applications and developer environments using @refinedev/inferencer through version 7.0.0, disable or block Inferencer-generated preview pages when connected to untrusted or third-party data providers, and note that no public exploit identified at time of analysis. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
React Server Components in React 19.x contain a critical pre-authentication remote code execution vulnerability (CVE-202
react-native-keys version 0.7.11 contains a sensitive information disclosure vulnerability where encryption ciphers and
HTML injection in Preact and React through unsafe JSON deserialization allows remote attackers to inject arbitrary scrip
Reflected XSS in Repostat's RepoCard React component prior to version 1.0.1 allows attackers to execute arbitrary JavaSc
OS command injection in create-react-app's react-dev-utils component enables remote code execution on macOS developer wo
Uncontrolled resource consumption in React Server Components (react-server-dom-parcel, react-server-dom-turbopack, react
Simple Membership (WordPress plugin) versions up to 4.7.0 contains a security vulnerability (CVSS 6.5).
React-Router versions up to 6.30.1 is affected by url redirection to untrusted site (open redirect) (CVSS 6.5).
Wekan is an open source kanban tool built with Meteor. [CVSS 6.5 MEDIUM]
React Router is a router for React. In @remix-run/server-runtime version prior to 2.17.3. [CVSS 6.5 MEDIUM]
Cross-site scripting in udecode Plate's core HTML deserialization APIs allows attacker-controlled script to execute in a
React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names a
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today